DRUPAL-CONTRIB-2023-020

DRUPAL-CONTRIB-2023-020

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This module enables you to define a 'weekly office hours' field type, and add a field to any Content type, in order to display the weekly opening hours for a location. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer display" regardless of other configurations. In some scenarios, the vulnerability can be exploited by a user with "Create content" or "Edit content" for a relevant Content type.

Fix available

Published

2023-06-14T14:52:36Z

Updated

2026-09-10T03:46:03.837384089Z

Stack: php

Check your server →